CVE-2025-64049: XSS
Published Nov 25, 2025
·Updated
A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.
Affected Software
3 affected componentsFixes available
REDCAXO CMS
composer/redaxo/source<5.20.1
5.20.1
REDAXO REDAXO=5.20.0
Event History
Nov 25, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:32 PM
Data Sourced
via GitHub·06:32 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-64049?
CVE-2025-64049 has been identified as a stored cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2025-64049?
To fix CVE-2025-64049, update REDAXO CMS to version 5.20.1 or later.
3
What component is affected by CVE-2025-64049?
CVE-2025-64049 affects the module management component in REDAXO CMS.
4
Who can exploit CVE-2025-64049?
Remote users can exploit CVE-2025-64049 to inject arbitrary web scripts or HTML.
5
When is CVE-2025-64049 triggered?
CVE-2025-64049 is triggered when a user views or edits an article containing a vulnerable slice.